target/riscv/debug.c

   1 /*
   2  * QEMU RISC-V Native Debug Support
   3  *
   4  * Copyright (c) 2022 Wind River Systems, Inc.
   5  *
   6  * Author:
   7  *   Bin Meng <bin.meng@windriver.com>
   8  *
   9  * This provides the native debug support via the Trigger Module, as defined
  10  * in the RISC-V Debug Specification:
  11  * https://github.com/riscv/riscv-debug-spec/raw/master/riscv-debug-stable.pdf
  12  *
  13  * This program is free software; you can redistribute it and/or modify it
  14  * under the terms and conditions of the GNU General Public License,
  15  * version 2 or later, as published by the Free Software Foundation.
  16  *
  17  * This program is distributed in the hope it will be useful, but WITHOUT
  18  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  19  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
  20  * more details.
  21  *
  22  * You should have received a copy of the GNU General Public License along with
  23  * this program.  If not, see <http://www.gnu.org/licenses/>.
  24  */
  25
  26 #include "qemu/osdep.h"
  27 #include "qemu/log.h"
  28 #include "qapi/error.h"
  29 #include "cpu.h"
  30 #include "trace.h"
  31 #include "exec/exec-all.h"
  32
  33 /*
  34  * The following M-mode trigger CSRs are implemented:
  35  *
  36  * - tselect
  37  * - tdata1
  38  * - tdata2
  39  * - tdata3
  40  * - tinfo
  41  *
  42  * The following triggers are initialized by default:
  43  *
  44  * Index | Type |          tdata mapping | Description
  45  * ------+------+------------------------+------------
  46  *     0 |    2 |         tdata1, tdata2 | Address / Data Match
  47  *     1 |    2 |         tdata1, tdata2 | Address / Data Match
  48  */
  49
  50 /* tdata availability of a trigger */
  51 typedef bool tdata_avail[TDATA_NUM];
  52
  53 static tdata_avail tdata_mapping[TRIGGER_TYPE_NUM] = {
  54     [TRIGGER_TYPE_NO_EXIST] = { false, false, false },
  55     [TRIGGER_TYPE_AD_MATCH] = { true, true, true },
  56     [TRIGGER_TYPE_INST_CNT] = { true, false, true },
  57     [TRIGGER_TYPE_INT] = { true, true, true },
  58     [TRIGGER_TYPE_EXCP] = { true, true, true },
  59     [TRIGGER_TYPE_AD_MATCH6] = { true, true, true },
  60     [TRIGGER_TYPE_EXT_SRC] = { true, false, false },
  61     [TRIGGER_TYPE_UNAVAIL] = { true, true, true }
  62 };
  63
  64 /* only breakpoint size 1/2/4/8 supported */
  65 static int access_size[SIZE_NUM] = {
  66     [SIZE_ANY] = 0,
  67     [SIZE_1B]  = 1,
  68     [SIZE_2B]  = 2,
  69     [SIZE_4B]  = 4,
  70     [SIZE_6B]  = -1,
  71     [SIZE_8B]  = 8,
  72     [6 ... 15] = -1,
  73 };
  74
  75 static inline target_ulong extract_trigger_type(CPURISCVState *env,
  76                                                 target_ulong tdata1)
  77 {
  78     switch (riscv_cpu_mxl(env)) {
  79     case MXL_RV32:
  80         return extract32(tdata1, 28, 4);
  81     case MXL_RV64:
  82     case MXL_RV128:
  83         return extract64(tdata1, 60, 4);
  84     default:
  85         g_assert_not_reached();
  86     }
  87 }
  88
  89 static inline target_ulong get_trigger_type(CPURISCVState *env,
  90                                             target_ulong trigger_index)
  91 {
  92     return extract_trigger_type(env, env->tdata1[trigger_index]);
  93 }
  94
  95 static trigger_action_t get_trigger_action(CPURISCVState *env,
  96                                            target_ulong trigger_index)
  97 {
  98     target_ulong tdata1 = env->tdata1[trigger_index];
  99     int trigger_type = get_trigger_type(env, trigger_index);
 100     trigger_action_t action = DBG_ACTION_NONE;
 101
 102     switch (trigger_type) {
 103     case TRIGGER_TYPE_AD_MATCH:
 104         action = (tdata1 & TYPE2_ACTION) >> 12;
 105         break;
 106     case TRIGGER_TYPE_AD_MATCH6:
 107         action = (tdata1 & TYPE6_ACTION) >> 12;
 108         break;
 109     case TRIGGER_TYPE_INST_CNT:
 110     case TRIGGER_TYPE_INT:
 111     case TRIGGER_TYPE_EXCP:
 112     case TRIGGER_TYPE_EXT_SRC:
 113         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 114                       trigger_type);
 115         break;
 116     case TRIGGER_TYPE_NO_EXIST:
 117     case TRIGGER_TYPE_UNAVAIL:
 118         qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 119                       trigger_type);
 120         break;
 121     default:
 122         g_assert_not_reached();
 123     }
 124
 125     return action;
 126 }
 127
 128 static inline target_ulong build_tdata1(CPURISCVState *env,
 129                                         trigger_type_t type,
 130                                         bool dmode, target_ulong data)
 131 {
 132     target_ulong tdata1;
 133
 134     switch (riscv_cpu_mxl(env)) {
 135     case MXL_RV32:
 136         tdata1 = RV32_TYPE(type) |
 137                  (dmode ? RV32_DMODE : 0) |
 138                  (data & RV32_DATA_MASK);
 139         break;
 140     case MXL_RV64:
 141     case MXL_RV128:
 142         tdata1 = RV64_TYPE(type) |
 143                  (dmode ? RV64_DMODE : 0) |
 144                  (data & RV64_DATA_MASK);
 145         break;
 146     default:
 147         g_assert_not_reached();
 148     }
 149
 150     return tdata1;
 151 }
 152
 153 bool tdata_available(CPURISCVState *env, int tdata_index)
 154 {
 155     int trigger_type = get_trigger_type(env, env->trigger_cur);
 156
 157     if (unlikely(tdata_index >= TDATA_NUM)) {
 158         return false;
 159     }
 160
 161     return tdata_mapping[trigger_type][tdata_index];
 162 }
 163
 164 target_ulong tselect_csr_read(CPURISCVState *env)
 165 {
 166     return env->trigger_cur;
 167 }
 168
 169 void tselect_csr_write(CPURISCVState *env, target_ulong val)
 170 {
 171     if (val < RV_MAX_TRIGGERS) {
 172         env->trigger_cur = val;
 173     }
 174 }
 175
 176 static target_ulong tdata1_validate(CPURISCVState *env, target_ulong val,
 177                                     trigger_type_t t)
 178 {
 179     uint32_t type, dmode;
 180     target_ulong tdata1;
 181
 182     switch (riscv_cpu_mxl(env)) {
 183     case MXL_RV32:
 184         type = extract32(val, 28, 4);
 185         dmode = extract32(val, 27, 1);
 186         tdata1 = RV32_TYPE(t);
 187         break;
 188     case MXL_RV64:
 189     case MXL_RV128:
 190         type = extract64(val, 60, 4);
 191         dmode = extract64(val, 59, 1);
 192         tdata1 = RV64_TYPE(t);
 193         break;
 194     default:
 195         g_assert_not_reached();
 196     }
 197
 198     if (type != t) {
 199         qemu_log_mask(LOG_GUEST_ERROR,
 200                       "ignoring type write to tdata1 register\n");
 201     }
 202
 203     if (dmode != 0) {
 204         qemu_log_mask(LOG_UNIMP, "debug mode is not supported\n");
 205     }
 206
 207     return tdata1;
 208 }
 209
 210 static inline void warn_always_zero_bit(target_ulong val, target_ulong mask,
 211                                         const char *msg)
 212 {
 213     if (val & mask) {
 214         qemu_log_mask(LOG_UNIMP, "%s bit is always zero\n", msg);
 215     }
 216 }
 217
 218 static void do_trigger_action(CPURISCVState *env, target_ulong trigger_index)
 219 {
 220     trigger_action_t action = get_trigger_action(env, trigger_index);
 221
 222     switch (action) {
 223     case DBG_ACTION_NONE:
 224         break;
 225     case DBG_ACTION_BP:
 226         riscv_raise_exception(env, RISCV_EXCP_BREAKPOINT, 0);
 227         break;
 228     case DBG_ACTION_DBG_MODE:
 229     case DBG_ACTION_TRACE0:
 230     case DBG_ACTION_TRACE1:
 231     case DBG_ACTION_TRACE2:
 232     case DBG_ACTION_TRACE3:
 233     case DBG_ACTION_EXT_DBG0:
 234     case DBG_ACTION_EXT_DBG1:
 235         qemu_log_mask(LOG_UNIMP, "action: %d is not supported\n", action);
 236         break;
 237     default:
 238         g_assert_not_reached();
 239     }
 240 }
 241
 242 /* type 2 trigger */
 243
 244 static uint32_t type2_breakpoint_size(CPURISCVState *env, target_ulong ctrl)
 245 {
 246     uint32_t size, sizelo, sizehi = 0;
 247
 248     if (riscv_cpu_mxl(env) == MXL_RV64) {
 249         sizehi = extract32(ctrl, 21, 2);
 250     }
 251     sizelo = extract32(ctrl, 16, 2);
 252     size = (sizehi << 2) | sizelo;
 253
 254     return size;
 255 }
 256
 257 static inline bool type2_breakpoint_enabled(target_ulong ctrl)
 258 {
 259     bool mode = !!(ctrl & (TYPE2_U | TYPE2_S | TYPE2_M));
 260     bool rwx = !!(ctrl & (TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
 261
 262     return mode && rwx;
 263 }
 264
 265 static target_ulong type2_mcontrol_validate(CPURISCVState *env,
 266                                             target_ulong ctrl)
 267 {
 268     target_ulong val;
 269     uint32_t size;
 270
 271     /* validate the generic part first */
 272     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH);
 273
 274     /* validate unimplemented (always zero) bits */
 275     warn_always_zero_bit(ctrl, TYPE2_MATCH, "match");
 276     warn_always_zero_bit(ctrl, TYPE2_CHAIN, "chain");
 277     warn_always_zero_bit(ctrl, TYPE2_ACTION, "action");
 278     warn_always_zero_bit(ctrl, TYPE2_TIMING, "timing");
 279     warn_always_zero_bit(ctrl, TYPE2_SELECT, "select");
 280     warn_always_zero_bit(ctrl, TYPE2_HIT, "hit");
 281
 282     /* validate size encoding */
 283     size = type2_breakpoint_size(env, ctrl);
 284     if (access_size[size] == -1) {
 285         qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
 286                       size);
 287     } else {
 288         val |= (ctrl & TYPE2_SIZELO);
 289         if (riscv_cpu_mxl(env) == MXL_RV64) {
 290             val |= (ctrl & TYPE2_SIZEHI);
 291         }
 292     }
 293
 294     /* keep the mode and attribute bits */
 295     val |= (ctrl & (TYPE2_U | TYPE2_S | TYPE2_M |
 296                     TYPE2_LOAD | TYPE2_STORE | TYPE2_EXEC));
 297
 298     return val;
 299 }
 300
 301 static void type2_breakpoint_insert(CPURISCVState *env, target_ulong index)
 302 {
 303     target_ulong ctrl = env->tdata1[index];
 304     target_ulong addr = env->tdata2[index];
 305     bool enabled = type2_breakpoint_enabled(ctrl);
 306     CPUState *cs = env_cpu(env);
 307     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 308     uint32_t size;
 309
 310     if (!enabled) {
 311         return;
 312     }
 313
 314     if (ctrl & TYPE2_EXEC) {
 315         cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
 316     }
 317
 318     if (ctrl & TYPE2_LOAD) {
 319         flags |= BP_MEM_READ;
 320     }
 321     if (ctrl & TYPE2_STORE) {
 322         flags |= BP_MEM_WRITE;
 323     }
 324
 325     if (flags & BP_MEM_ACCESS) {
 326         size = type2_breakpoint_size(env, ctrl);
 327         if (size != 0) {
 328             cpu_watchpoint_insert(cs, addr, size, flags,
 329                                   &env->cpu_watchpoint[index]);
 330         } else {
 331             cpu_watchpoint_insert(cs, addr, 8, flags,
 332                                   &env->cpu_watchpoint[index]);
 333         }
 334     }
 335 }
 336
 337 static void type2_breakpoint_remove(CPURISCVState *env, target_ulong index)
 338 {
 339     CPUState *cs = env_cpu(env);
 340
 341     if (env->cpu_breakpoint[index]) {
 342         cpu_breakpoint_remove_by_ref(cs, env->cpu_breakpoint[index]);
 343         env->cpu_breakpoint[index] = NULL;
 344     }
 345
 346     if (env->cpu_watchpoint[index]) {
 347         cpu_watchpoint_remove_by_ref(cs, env->cpu_watchpoint[index]);
 348         env->cpu_watchpoint[index] = NULL;
 349     }
 350 }
 351
 352 static void type2_reg_write(CPURISCVState *env, target_ulong index,
 353                             int tdata_index, target_ulong val)
 354 {
 355     target_ulong new_val;
 356
 357     switch (tdata_index) {
 358     case TDATA1:
 359         new_val = type2_mcontrol_validate(env, val);
 360         if (new_val != env->tdata1[index]) {
 361             env->tdata1[index] = new_val;
 362             type2_breakpoint_remove(env, index);
 363             type2_breakpoint_insert(env, index);
 364         }
 365         break;
 366     case TDATA2:
 367         if (val != env->tdata2[index]) {
 368             env->tdata2[index] = val;
 369             type2_breakpoint_remove(env, index);
 370             type2_breakpoint_insert(env, index);
 371         }
 372         break;
 373     case TDATA3:
 374         qemu_log_mask(LOG_UNIMP,
 375                       "tdata3 is not supported for type 2 trigger\n");
 376         break;
 377     default:
 378         g_assert_not_reached();
 379     }
 380
 381     return;
 382 }
 383
 384 /* type 6 trigger */
 385
 386 static inline bool type6_breakpoint_enabled(target_ulong ctrl)
 387 {
 388     bool mode = !!(ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M));
 389     bool rwx = !!(ctrl & (TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 390
 391     return mode && rwx;
 392 }
 393
 394 static target_ulong type6_mcontrol6_validate(CPURISCVState *env,
 395                                              target_ulong ctrl)
 396 {
 397     target_ulong val;
 398     uint32_t size;
 399
 400     /* validate the generic part first */
 401     val = tdata1_validate(env, ctrl, TRIGGER_TYPE_AD_MATCH6);
 402
 403     /* validate unimplemented (always zero) bits */
 404     warn_always_zero_bit(ctrl, TYPE6_MATCH, "match");
 405     warn_always_zero_bit(ctrl, TYPE6_CHAIN, "chain");
 406     warn_always_zero_bit(ctrl, TYPE6_ACTION, "action");
 407     warn_always_zero_bit(ctrl, TYPE6_TIMING, "timing");
 408     warn_always_zero_bit(ctrl, TYPE6_SELECT, "select");
 409     warn_always_zero_bit(ctrl, TYPE6_HIT, "hit");
 410
 411     /* validate size encoding */
 412     size = extract32(ctrl, 16, 4);
 413     if (access_size[size] == -1) {
 414         qemu_log_mask(LOG_UNIMP, "access size %d is not supported, using SIZE_ANY\n",
 415                       size);
 416     } else {
 417         val |= (ctrl & TYPE6_SIZE);
 418     }
 419
 420     /* keep the mode and attribute bits */
 421     val |= (ctrl & (TYPE6_VU | TYPE6_VS | TYPE6_U | TYPE6_S | TYPE6_M |
 422                     TYPE6_LOAD | TYPE6_STORE | TYPE6_EXEC));
 423
 424     return val;
 425 }
 426
 427 static void type6_breakpoint_insert(CPURISCVState *env, target_ulong index)
 428 {
 429     target_ulong ctrl = env->tdata1[index];
 430     target_ulong addr = env->tdata2[index];
 431     bool enabled = type6_breakpoint_enabled(ctrl);
 432     CPUState *cs = env_cpu(env);
 433     int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 434     uint32_t size;
 435
 436     if (!enabled) {
 437         return;
 438     }
 439
 440     if (ctrl & TYPE6_EXEC) {
 441         cpu_breakpoint_insert(cs, addr, flags, &env->cpu_breakpoint[index]);
 442     }
 443
 444     if (ctrl & TYPE6_LOAD) {
 445         flags |= BP_MEM_READ;
 446     }
 447
 448     if (ctrl & TYPE6_STORE) {
 449         flags |= BP_MEM_WRITE;
 450     }
 451
 452     if (flags & BP_MEM_ACCESS) {
 453         size = extract32(ctrl, 16, 4);
 454         if (size != 0) {
 455             cpu_watchpoint_insert(cs, addr, size, flags,
 456                                   &env->cpu_watchpoint[index]);
 457         } else {
 458             cpu_watchpoint_insert(cs, addr, 8, flags,
 459                                   &env->cpu_watchpoint[index]);
 460         }
 461     }
 462 }
 463
 464 static void type6_breakpoint_remove(CPURISCVState *env, target_ulong index)
 465 {
 466     type2_breakpoint_remove(env, index);
 467 }
 468
 469 static void type6_reg_write(CPURISCVState *env, target_ulong index,
 470                             int tdata_index, target_ulong val)
 471 {
 472     target_ulong new_val;
 473
 474     switch (tdata_index) {
 475     case TDATA1:
 476         new_val = type6_mcontrol6_validate(env, val);
 477         if (new_val != env->tdata1[index]) {
 478             env->tdata1[index] = new_val;
 479             type6_breakpoint_remove(env, index);
 480             type6_breakpoint_insert(env, index);
 481         }
 482         break;
 483     case TDATA2:
 484         if (val != env->tdata2[index]) {
 485             env->tdata2[index] = val;
 486             type6_breakpoint_remove(env, index);
 487             type6_breakpoint_insert(env, index);
 488         }
 489         break;
 490     case TDATA3:
 491         qemu_log_mask(LOG_UNIMP,
 492                       "tdata3 is not supported for type 6 trigger\n");
 493         break;
 494     default:
 495         g_assert_not_reached();
 496     }
 497
 498     return;
 499 }
 500
 501 target_ulong tdata_csr_read(CPURISCVState *env, int tdata_index)
 502 {
 503     switch (tdata_index) {
 504     case TDATA1:
 505         return env->tdata1[env->trigger_cur];
 506     case TDATA2:
 507         return env->tdata2[env->trigger_cur];
 508     case TDATA3:
 509         return env->tdata3[env->trigger_cur];
 510     default:
 511         g_assert_not_reached();
 512     }
 513 }
 514
 515 void tdata_csr_write(CPURISCVState *env, int tdata_index, target_ulong val)
 516 {
 517     int trigger_type;
 518
 519     if (tdata_index == TDATA1) {
 520         trigger_type = extract_trigger_type(env, val);
 521     } else {
 522         trigger_type = get_trigger_type(env, env->trigger_cur);
 523     }
 524
 525     switch (trigger_type) {
 526     case TRIGGER_TYPE_AD_MATCH:
 527         type2_reg_write(env, env->trigger_cur, tdata_index, val);
 528         break;
 529     case TRIGGER_TYPE_AD_MATCH6:
 530         type6_reg_write(env, env->trigger_cur, tdata_index, val);
 531         break;
 532     case TRIGGER_TYPE_INST_CNT:
 533     case TRIGGER_TYPE_INT:
 534     case TRIGGER_TYPE_EXCP:
 535     case TRIGGER_TYPE_EXT_SRC:
 536         qemu_log_mask(LOG_UNIMP, "trigger type: %d is not supported\n",
 537                       trigger_type);
 538         break;
 539     case TRIGGER_TYPE_NO_EXIST:
 540     case TRIGGER_TYPE_UNAVAIL:
 541         qemu_log_mask(LOG_GUEST_ERROR, "trigger type: %d does not exit\n",
 542                       trigger_type);
 543         break;
 544     default:
 545         g_assert_not_reached();
 546     }
 547 }
 548
 549 target_ulong tinfo_csr_read(CPURISCVState *env)
 550 {
 551     /* assume all triggers support the same types of triggers */
 552     return BIT(TRIGGER_TYPE_AD_MATCH) |
 553            BIT(TRIGGER_TYPE_AD_MATCH6);
 554 }
 555
 556 void riscv_cpu_debug_excp_handler(CPUState *cs)
 557 {
 558     RISCVCPU *cpu = RISCV_CPU(cs);
 559     CPURISCVState *env = &cpu->env;
 560
 561     if (cs->watchpoint_hit) {
 562         if (cs->watchpoint_hit->flags & BP_CPU) {
 563             cs->watchpoint_hit = NULL;
 564             do_trigger_action(env, DBG_ACTION_BP);
 565         }
 566     } else {
 567         if (cpu_breakpoint_test(cs, env->pc, BP_CPU)) {
 568             do_trigger_action(env, DBG_ACTION_BP);
 569         }
 570     }
 571 }
 572
 573 bool riscv_cpu_debug_check_breakpoint(CPUState *cs)
 574 {
 575     RISCVCPU *cpu = RISCV_CPU(cs);
 576     CPURISCVState *env = &cpu->env;
 577     CPUBreakpoint *bp;
 578     target_ulong ctrl;
 579     target_ulong pc;
 580     int trigger_type;
 581     int i;
 582
 583     QTAILQ_FOREACH(bp, &cs->breakpoints, entry) {
 584         for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 585             trigger_type = get_trigger_type(env, i);
 586
 587             switch (trigger_type) {
 588             case TRIGGER_TYPE_AD_MATCH:
 589                 /* type 2 trigger cannot be fired in VU/VS mode */
 590                 if (riscv_cpu_virt_enabled(env)) {
 591                     return false;
 592                 }
 593
 594                 ctrl = env->tdata1[i];
 595                 pc = env->tdata2[i];
 596
 597                 if ((ctrl & TYPE2_EXEC) && (bp->pc == pc)) {
 598                     /* check U/S/M bit against current privilege level */
 599                     if ((ctrl >> 3) & BIT(env->priv)) {
 600                         return true;
 601                     }
 602                 }
 603                 break;
 604             case TRIGGER_TYPE_AD_MATCH6:
 605                 ctrl = env->tdata1[i];
 606                 pc = env->tdata2[i];
 607
 608                 if ((ctrl & TYPE6_EXEC) && (bp->pc == pc)) {
 609                     if (riscv_cpu_virt_enabled(env)) {
 610                         /* check VU/VS bit against current privilege level */
 611                         if ((ctrl >> 23) & BIT(env->priv)) {
 612                             return true;
 613                         }
 614                     } else {
 615                         /* check U/S/M bit against current privilege level */
 616                         if ((ctrl >> 3) & BIT(env->priv)) {
 617                             return true;
 618                         }
 619                     }
 620                 }
 621                 break;
 622             default:
 623                 /* other trigger types are not supported or irrelevant */
 624                 break;
 625             }
 626         }
 627     }
 628
 629     return false;
 630 }
 631
 632 bool riscv_cpu_debug_check_watchpoint(CPUState *cs, CPUWatchpoint *wp)
 633 {
 634     RISCVCPU *cpu = RISCV_CPU(cs);
 635     CPURISCVState *env = &cpu->env;
 636     target_ulong ctrl;
 637     target_ulong addr;
 638     int trigger_type;
 639     int flags;
 640     int i;
 641
 642     for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 643         trigger_type = get_trigger_type(env, i);
 644
 645         switch (trigger_type) {
 646         case TRIGGER_TYPE_AD_MATCH:
 647             /* type 2 trigger cannot be fired in VU/VS mode */
 648             if (riscv_cpu_virt_enabled(env)) {
 649                 return false;
 650             }
 651
 652             ctrl = env->tdata1[i];
 653             addr = env->tdata2[i];
 654             flags = 0;
 655
 656             if (ctrl & TYPE2_LOAD) {
 657                 flags |= BP_MEM_READ;
 658             }
 659             if (ctrl & TYPE2_STORE) {
 660                 flags |= BP_MEM_WRITE;
 661             }
 662
 663             if ((wp->flags & flags) && (wp->vaddr == addr)) {
 664                 /* check U/S/M bit against current privilege level */
 665                 if ((ctrl >> 3) & BIT(env->priv)) {
 666                     return true;
 667                 }
 668             }
 669             break;
 670         case TRIGGER_TYPE_AD_MATCH6:
 671             ctrl = env->tdata1[i];
 672             addr = env->tdata2[i];
 673             flags = 0;
 674
 675             if (ctrl & TYPE6_LOAD) {
 676                 flags |= BP_MEM_READ;
 677             }
 678             if (ctrl & TYPE6_STORE) {
 679                 flags |= BP_MEM_WRITE;
 680             }
 681
 682             if ((wp->flags & flags) && (wp->vaddr == addr)) {
 683                 if (riscv_cpu_virt_enabled(env)) {
 684                     /* check VU/VS bit against current privilege level */
 685                     if ((ctrl >> 23) & BIT(env->priv)) {
 686                         return true;
 687                     }
 688                 } else {
 689                     /* check U/S/M bit against current privilege level */
 690                     if ((ctrl >> 3) & BIT(env->priv)) {
 691                         return true;
 692                     }
 693                 }
 694             }
 695             break;
 696         default:
 697             /* other trigger types are not supported */
 698             break;
 699         }
 700     }
 701
 702     return false;
 703 }
 704
 705 void riscv_trigger_init(CPURISCVState *env)
 706 {
 707     target_ulong tdata1 = build_tdata1(env, TRIGGER_TYPE_AD_MATCH, 0, 0);
 708     int i;
 709
 710     /* init to type 2 triggers */
 711     for (i = 0; i < RV_MAX_TRIGGERS; i++) {
 712         /*
 713          * type = TRIGGER_TYPE_AD_MATCH
 714          * dmode = 0 (both debug and M-mode can write tdata)
 715          * maskmax = 0 (unimplemented, always 0)
 716          * sizehi = 0 (match against any size, RV64 only)
 717          * hit = 0 (unimplemented, always 0)
 718          * select = 0 (always 0, perform match on address)
 719          * timing = 0 (always 0, trigger before instruction)
 720          * sizelo = 0 (match against any size)
 721          * action = 0 (always 0, raise a breakpoint exception)
 722          * chain = 0 (unimplemented, always 0)
 723          * match = 0 (always 0, when any compare value equals tdata2)
 724          */
 725         env->tdata1[i] = tdata1;
 726         env->tdata2[i] = 0;
 727         env->tdata3[i] = 0;
 728         env->cpu_breakpoint[i] = NULL;
 729         env->cpu_watchpoint[i] = NULL;
 730     }
 731 }